Chords Fetcher

What to consider before installing: - The code and instructions align with the stated purpose (searching and scraping chords), but there is a logic bug in search_chords that can return arbitrary URLs instead of only the target domains. That means the agent may fetch unexpected web pages (including internal network endpoints) if a search result contains them. - If you plan to run this skill, do so in a restricted environment (sandbox or network-restricted container) until you audit or patch the code. - Quick fix suggestions a reviewer or developer can apply before use: - Change the ultimate-guitar branch condition to require the expected host, e.g. use an AND check: if 'ultimate-guitar.com/tabs/' in href and 'ultimate-guitar.com/pro/' not in href (or better: parse the URL and assert the hostname equals the expected domain). - Prefer parsing the href hostname with urllib.parse to enforce an allow-list of hosts (mychords.net, amdm.ru, ultimate-guitar.com) rather than string containment checks. - Remove unused variables (query_clean) and add explicit checks that URLs start with http:// or https://. - Document and warn that the script performs outbound network requests and that running it could contact external sites. - If you cannot or will not run the code in a sandbox, do not install this skill. If you trust the environment and accept the network behavior, it is otherwise coherent with its stated purpose.